Originally Posted by brendan

why not just

Code:

vi /etc/sysconfig/iptables

?

Originally Posted by Ricky-Lee

[1|root@minidemon|~]ls /etc/sysconfig/iptables
ls: /etc/sysconfig/iptables: No such file or directory

Originally Posted by gsagers

Thanks, great tip! I'd offer the following change for those who want remote SSH access to their Nokia from anywhere - and if I typed something wrong, please correct me - I'm no iptables guru, but it seems to work here!

Code:

#!/bin/sh
iptables -F
iptables -A INPUT -p all -s 127.0.0.1 -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -p tcp --syn -j DROP

Originally Posted by allnameswereout

NOTE you should accept traffic to/from local loopback device instead of 127.0.0.1. You should deny traffic from 127.0.0.1 on network because this can only be spoofed traffic. However, I'm no IPT wizard; I prefer OpenBSD PF.

Originally Posted by brendan

no, it should be

Code:

iptables -A INPUT -p all -s lo -j ACCEPT

since ifconfig uses the lo convention, not loopback for the name of that interface.

as far as the reverse port forwarding you do with ssh, i dont think that would be killed via iptables, because the traffic would be tunneled through ssh, not be a seperate connection. you would have to be listening for ssh on all interfaces too, not just the wlan0 interface.

you sshd_config should have the following directive:

Code:

ListenAddress 0.0.0.0

Originally Posted by brendan

since the ListenAddress is commented out with 0.0.0.0 as a value, that means its the default, and therefore the daemon listens on all interfaces.

Code:

netstat -na |grep 22

should confirm